Nexus as a Single Proxy for Maven, npm and Docker in CI

Our CI builds used to fail a few times a month for reasons that had nothing to do with our code: Maven Central was slow, npm returned a 503, or Docker Hub rate-limited the build agents. Putting Sonatype Nexus Repository in front of every public registry made those failures disappear, and it gave us one place to control what enters the build.

The repository model

For each format, create three kinds of repository:

• proxy – caches a remote registry (Maven Central, npmjs, Docker Hub).
• hosted – stores what your team publishes (release JARs, internal npm packages, app images).
• group – one URL that combines hosted + proxies. Clients only ever talk to the group.

maven-public  (group)  = maven-releases + maven-snapshots + maven-central-proxy
npm-group     (group)  = npm-hosted + npmjs-proxy
docker-group  (group)  = docker-hosted + dockerhub-proxy

Maven: one mirror for everything

<!-- ~/.m2/settings.xml on the build agents -->
<settings>
  <mirrors>
    <mirror>
      <id>nexus</id>
      <mirrorOf>*</mirrorOf>
      <url>https://nexus.example.com/repository/maven-public/</url>
    </mirror>
  </mirrors>
</settings>

In Jenkins, manage this file with the Config File Provider plugin and inject it with configFileProvider, so credentials for deploying to maven-releases never live in a repo.

npm

npm config set registry https://nexus.example.com/repository/npm-group/

Or commit an .npmrc with that line to each project, so local builds and CI resolve packages the same way.

Docker

Give the Docker group repository its own HTTPS connector or a path-based route through your reverse proxy, then pull through it:

docker pull nexus.example.com:8443/library/eclipse-temurin:21-jre
# in Dockerfiles
FROM nexus.example.com:8443/library/maven:3.9-eclipse-temurin-21 AS build

Push application images to the hosted repository and let Kubernetes pull them from the same group URL.

Housekeeping that saves you later

1. Cleanup policies. Delete snapshot and feature-branch images older than 30 days, then run the compact blob store task. Otherwise the disk fills quietly.
2. Separate blob stores per format, so a runaway Docker cache cannot starve Maven.
3. Disable anonymous access unless you really need it, and use service accounts per pipeline.
4. Keep Nexus itself patched. It sits in the middle of your supply chain; a compromise here reaches every build.
5. Block known-bad versions. When a malicious package version is announced, removing or blocking it in the proxy protects every build agent at once.

The result: faster builds, no rate limits, and a single choke point where you can stop a bad dependency before it reaches production.